It has been seen that security testers input either ' or ; into the application entry points to test for SQL injection. Why are these characters used?
' is used because this is the character limiter in SQL. With
' you delimit strings and therefore you can test whether the strings are properly escaped in the targeted application or not. If they are not escaped directly you can end any string supplied to the application and add other SQL code after that.
; is used to terminate SQL statements. If you can send the character
; to an application and it is not escaped outside a string (see above) then you can terminate any SQL statement and create a new one which leaves a security breach.
Read Wikipedia's examples of SQL injections, in particular the "Incorrectly filtered escape characters" section.
Essentially, in an injection you are expected to provide a ready-made command with a parameter. You build this parameter in such a way that it contains an embedded command, whilst respecting the syntax of SQL.
Since a command is typically
SELECT FROM / UPDATE WHERE FOO='<your entry point>', you can use
nop'; Your own command here. The combination of the two will give a sequence of two syntactically valid commands which will both be executed.
To prevent SQL injections, make you that you validate all untrusted input by verifying that it belongs to a white-listed domain of accepted inputs (here typically escape special characters), and also ensure that you delegate command composition to the DB API you use rather than doing it yourself: use a different call for providing the command and the parameters so the API you rely on can do additional checks and avoid you further embarassment!
Testers are trying to find bugs that they can get credit for finding; they are not trying to find the last remaining problem.
In most cases the input is checked before being passing into SQL by a well written function, or a parameter is used. Therefore it is likely that if even the most basic type of SQL-injection is stopped, then all types of SQL-injection is stopped for the given form field.
So just putting a
‘ in each entry point is a quick and easy way to get a lot of benefit for the tester and the tester's employer.
(Likewise a lot of tester will copy/paste in a very long bit of text, even if no user will ever do so, as it is a quick way to check if the application is coded to cope with inputs that are too long.)